Course 44 - RH Security Specialist | Episode 12: Securing Linux with Nessus and IPTables

How can you determine whether a Linux server contains known security weaknesses—and how can you control the network traffic reaching those services?In this episode, we focus on two essential pillars of Linux server defense: proactive vulnerability assessment and active firewall protection.We begin with Nessus, exploring how vulnerability scanners identify operating systems, software versions, exposed services, and known security weaknesses. We then move into the defensive side of the equation with IPTables and the Linux netfilter framework, examining how host-based firewall rules can control network traffic and reduce the system's attack surface.The episode concludes with practical rule-management concepts, including rule ordering, traffic filtering, configuration persistence, and the importance of validating firewall behavior after changes.1. Introducing Vulnerability Scanning with NessusSecurity administrators cannot effectively protect systems without understanding their weaknesses.We begin by introducing Nessus Home, a vulnerability-assessment platform designed to help identify security issues within systems and networks.You will explore the process of:Obtaining and activating a Nessus license.Installing the Nessus package using RPM.Initializing the Nessus service.Accessing the management interface through a web browser.Preparing a vulnerability assessment.Reviewing the results generated by the scanner.This establishes the first major principle of the episode:You cannot effectively remediate vulnerabilities that you have not identified.2. Building an Advanced Vulnerability ScanOnce Nessus is operational, we examine how an advanced scan can gather information about a target environment.A vulnerability assessment may identify information such as:Operating-system characteristics.Running services.Software versions.Network exposure.Known vulnerabilities.Configuration weaknesses.Security recommendations.The objective is not simply to produce a list of vulnerabilities, but to understand the security posture of the system and determine which findings require attention.All scanning activities should be performed against systems you own or are explicitly authorized to assess.3. Understanding False PositivesAutomated vulnerability scanners are powerful, but they are not infallible.A scanner may sometimes report a vulnerability that does not actually exist. These findings are known as false positives.This introduces an important professional skill: security validation.When a vulnerability is reported, administrators should investigate the underlying evidence rather than automatically assuming the finding is accurate.A responsible assessment therefore follows this cycle:Scan → Analyze → Validate → Remediate → RescanUnderstanding false positives prevents unnecessary remediation while ensuring genuine vulnerabilities receive appropriate attention.4. Introducing IPTables and NetfilterAfter examining how vulnerabilities can be discovered, we shift toward preventing unwanted network access.IPTables provides a traditional command-line interface for managing Linux firewall rules, while the underlying packet-filtering functionality is provided by the Linux kernel's netfilter framework.Together, they allow administrators to control how network packets are processed by the system.Firewall policies can be used to:Permit legitimate network services.Restrict unnecessary connections.Block unwanted traffic.Limit exposure to untrusted networks.Reduce the attack surface of a server.This is particularly important because threats do not always originate from outside the organization. A compromised workstation, internal attacker, or infected device may also attempt to reach vulnerable services.5. Stateful and Stateless Packet FilteringUnderstanding firewall behavior requires understanding how packets are evaluated.Linux firewalling can support both stateless filtering, where individual packets are evaluated according to their characteristics, and stateful filtering, where connection state is considered when determining whether traffic should be allowed.This distinction is important because modern network security often requires more than simply examining source and destination addresses.Administrators need to understand:Where traffic originates.Where it is going.Which protocol it uses.Which port is involved.Whether the traffic belongs to an established connection.What the firewall policy should do with the packet.6. Managing Firewall Rules from the Command LineWe then m